Viewed   18 times

This is output after i run df -h

Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        30G   19G  9.1G  68% /
none            4.0K     0  4.0K   0% /sys/fs/cgroup
udev            487M  4.0K  487M   1% /dev
tmpfs           100M  348K  100M   1% /run
none            5.0M     0  5.0M   0% /run/lock
none            498M     0  498M   0% /run/shm
none            100M     0  100M   0% /run/user
/dev/sda         25G  6.4G   17G  28% /mnt/volume-sgp1-01

I want to identify what are 19G being used.

So i run below command

du -h --max-depth=10 --one-file-system / | sort -rh | head -25

to get following output

14G /
12G /var
8.8G    /var/lib
8.6G    /var/lib/mysql
8.1G    /var/lib/mysql/getapple_phpbb
1.6G    /var/www
916M    /usr
546M    /var/www/
546M    /var/www/
517M    /var/www/
464M    /lib
431M    /var/www/
431M    /var/www/
396M    /home
381M    /var/www/
381M    /var/www/
378M    /var/lib/mysql/getapple_paysmile
368M    /lib/modules
306M    /var/www/
295M    /usr/lib
255M    /var/www/
255M    /var/www/
250M    /opt
244M    /usr/share
242M    /opt/datadog-agent

you can see that the main directory being used is / which is only 14gb

So where are the remaining 5GB are being used?

Please advise.



Try to execute lsof | grep delete, you could find there deleted files that haven't seen by du, but use disk. Also you could find process PID who lock this files. Restart it and take your disk space back!

Thursday, March 9, 2023

One simple way to get Windows Server 2008 to send low disk space e-mail alerts is to use Task Scheduler and the System Log. If the free space falls below the percentage specified in HKLMSYSTEMCurrentControlSetServicesLanmanServerParametersDiskSpaceThreshold, an event is recorded in the System Log that can trigger a task to send an e-mail message.

  1. Open Task Scheduler and create a new task.
  2. Enter a name for the task, select "Run whether user is logged on or not", and check "Do not store password."
  3. Add a new trigger on the Triggers tab.
  4. Select "On an event" in the "Begin the task" box.
  5. Set Log to "System", Source to "srv", and Event ID to "2013".
  6. Add a new action on the Actions tab.
  7. Set Action to "Send an e-mail" and fill in the rest of the settings appropriately.
  8. To configure when the low disk space event is recorded in the System Log, open the Registry Editor, navigate to HKLMSYSTEMCurrentControlSetServicesLanmanServerParameters and add a DWORD value named “DiskSpaceThreshold”, setting it to the desired percentage. When the entry does not exist, the de value is 10.
Monday, December 26, 2022

(This is a Linux focused answer. Other UNIX variants may be different.)

There are two pieces of information relevant to your problem: (1) which files are filling up your file system, and (2) which processes are writing to those files.


Below, when I put the $ character in commands, that's probably a place holder where you need to substitute a real value. Hopefully, it's obvious where to do that and where not to.

Which Files?

Be aware that there are really two resources in most file system types that can be used up by individual files: meta-data (e.g. inodes), and real data. You can see the number of inodes (search Google for a definition, but they're "pointers" to the structures that make up your files) with a command like:

df -i

... and as you already know, something like this will show the space being used by real data:

df -h

Also, be aware that file system space can be taken up by files that don't exist on disk. These files are still in the open state by some process, but have been removed (we'll cover that below).

Once you've identified the full file system(s), then you need to start looking for lots of little files, a few big files, or both. Running out of meta-data resources is usually caused by having lots of little files, whereas running out of real data resources is usually caused by a few big files. I like to use this command to help find the big files:

sudo find $file_system -mount -ls | awk '{print $7, $11}' | sort -rn > $output

... and this command to help find directories with lots of little files (Update:: added null termination to improve file name handling):

sudo find . -mount -print0 | xargs -0n 1 dirname | sort | uniq -c | sort -rn > $output

... be aware that these commands may take a while to run, and do a lot of I/O, depending. Once run, you can read through $output to find the offending files or directories. The name and location of each may give you a hint about where the data's coming from, but requires some Linux experience.

Once you've identified the offenders, you can rm $file to get rid of the problem.

Which Processes?

The most straight forward way to find the processes potentially filling up your file system is to run a command like:

fuser -c $file_system 2>/dev/null

... which will tell you the PID of processes that have open file descriptors (files and network sockets) for the given file system (the 2>/dev/null part gets rid of some information you don't need). You might be able to deduce just from these PIDs which process is filling up your file system. Search for the processes with:

ps -ef | grep $pid

You can also try running this command which will give you even more detail (and help identify open files with no corresponding file name on the disk -- I mentioned this above):

sudo lsof $file_system | grep $directory_filling_up

... and if you've identified a suspect PID from the fuser command, you can do this:

sudo lsof -p $pid

The problem with fuser and lsof is that they only give you a snapshot of the system at the time your run the command. If the offending process doesn't happen to be writing when you run them, you're out of luck. You can counter this by repeatedly running them over time and saving the output. This will require reading through the output to find patterns, or writing a program to do it for you. An alternative is to use a tool like SystemTap. SystemTap allows you to trap all kinds of useful information, and is "programmable." It even comes with some sample source files that would allow you see what processes are writing to what files over some span of time. It would be perfect, but it's an advanced tool and requires a lot of Linux knowledge.

Once you've identified the offending process(es), you can kill (and maybe restart them). If the process is associated with the operating system or some well packaged software, there will probably be a mechanism for restarting them, but it will depend on your Linux distro (I think Ubuntu will allow you to run something like /etc/init.d/$init_script restart, but you'll have to check your distro's documentation). Otherwise, you can kill it with kill $pid or kill -9 $pid if it's not behaving. Be careful to note how the process was running (e.g. what were it's arguments shown in ps -ef) in case you need to restart it (you may need to refer to that software's documentation).

Sunday, September 11, 2022

It appears to be the System Restore that take this space. I go to Control Panel > System > System Protection > (select drive) > Configure and find out the huge size of the system restore file. It is quite weird though that the file is found in (E:) instead of (H:), despite taking the size from (H:). After clearing the system restore then I manage to get back the free space. I did remove the system restore file from (H:) as well.

Another weird thing is that the system restore is disabled for this drive (see the radiobutton selected), but despite that, it still create the system restore file.

Sunday, September 11, 2022

Yes, df -h (Disk Free) will show the free space on each of the mounted file systems.

So cd to the filesystem that's full, and du -sh * (Disk Usage) will show the total space used by each of the files/directories in the current working directory. The --max-depth option for du may also be useful here.

Finding exactly what is responsible for using all the space can be somewhat of an art - This answer lists some graphical utilities that can make that easier, though of course this isn't helpful in your case.

The simplest approach is just to work your way into the directory structure of the filesystem in question, trying to isolate files or directories that are taking up more space than expected.

Note: It's also worth running df -i to check the you haven't run out of inodes (ifree should be non-zero on writable partitions) - this can happen on some filesystems, especially if a larger number of small files have been created.

Saturday, September 10, 2022
Only authorized users can answer the search term. Please sign in first, or register a free account.
Not the answer you're looking for? Browse other questions tagged :